Privacy Policy
Last updated: July 9, 2026
AtPace ("we", "us") is an AI sports-coaching application. This policy explains what personal data we collect through the AtPace mobile application and this website, why we collect it, and the rights you have over it. It is governed by the EU General Data Protection Regulation (GDPR).
1. Data controller
The data controller is Kiyan Meliani, 51 rue de Villiers, 92200 Neuilly-sur-Seine, France. Contact: support@atpace.app.
2. Data we collect
| Category | Data | Purpose |
|---|---|---|
| Account | Name, email address, username, password (hashed), profile photo (optional), language | Create and operate your account, sign-in, social features |
| Training profile | Gender, date of birth, weight, height, training level, goals, available equipment, training days, coaching notes | Generate and adapt your training programs |
| Health-related | Injuries and physical limitations you declare (body area + how to handle them) | Adapt or remove exercises so your program is safe. Provided voluntarily and used only for this purpose. |
| Training activity | Workouts, sets, reps, weights, durations, personal records, session feedback (RPE), trophies, XP | Track progress, compute statistics, adapt future sessions |
| Nutrition | Logged meals (foods, quantities, calories, macros), meal photos you take, barcodes you scan, nutrition targets | Track your nutrition, analyze your meals (photo/text, Premium feature), compute your calorie targets |
| Morphology (optional) | Physique photos you voluntarily submit, and the per-muscle development scores and body-composition estimate derived from them | Morphology analysis (Premium feature): identify strong/lagging muscle groups and steer your training volume. Deletable at any time (Profile → morphology analysis) |
| Health & activity (optional — watch/band) | Daily aggregates read from Apple Health or Health Connect: sleep duration, heart-rate variability (HRV), resting heart rate, active calories, steps, weight | Sharpen your readiness score, adapt sessions to your actual recovery, keep your profile weight up to date. See the "Health & activity data" section |
| Social | Friend connections, direct messages, shared sessions/templates/programs, published programs | The in-app social features you choose to use |
| Subscription | Subscription status and store transaction identifiers (via RevenueCat). We never see your card or bank details — payment is handled entirely by Apple or Google. | Unlock and manage At Pace Premium |
| Technical | Push notification token, device platform, app version, crash and error reports | Notifications you enabled, reliability and bug fixing |
3. Health & activity data (watches & bands)
If you connect your watch or fitness band (Profile → My watch), AtPace reads data from your phone's health aggregator: Apple Health (HealthKit) on iOS, Health Connect on Android. This feature is optional and off by default: nothing is read without your explicit consent, given twice — first on an AtPace screen detailing the data involved, then through the system permission prompt.
What we read — and what we don't
- Read-only. AtPace never writes anything to Apple Health or Health Connect.
- Data read: sleep duration, heart-rate variability (HRV), resting heart rate, active calories, step count, weight.
- Daily aggregates only. The app computes one total per day on your phone (e.g. "7 h 12 min of sleep on the night to July 9"); only these totals ever leave your device. Detailed measurements (minute-by-minute samples, sleep stages, heart-rate curves) are never transmitted to or stored on our servers.
- We read neither your location, nor the workouts recorded by your watch, nor any other health category.
What they are used for
- Computing your readiness score: your recent training load is blended with your recovery signals (sleep, HRV and resting heart rate compared to your own 30-day average).
- Letting the AI coach adapt your sessions: when a signal is degraded (short night, HRV below your baseline), the context sent to the AI model mentions it — see the "AI processing" section.
- Automatically updating your profile weight, which drives your load and calorie-target calculations.
Where they live, for how long
- On your phone (the app's local storage, for offline use) and on our servers hosted by OVH in France — only the daily aggregates described above.
- They are kept for as long as your account exists and permanently deleted with it. You can also request their isolated erasure at support@atpace.app.
Your control
- Disconnect at any time in Profile → My watch: AtPace immediately stops all reading and uploading.
- Revoke the system permission: on iOS in Settings → Health → Data Access; on Android in the Health Connect app → Permissions.
- This data qualifies as health data under GDPR Article 9: its processing rests exclusively on your explicit consent, withdrawable at any time without affecting the rest of the service.
In line with Apple's and Google's rules: data obtained from HealthKit and Health Connect is never used for advertising or marketing, never sold, never handed to data brokers, and never used for any purpose other than the features described here.
4. AI processing
Program generation, the coach chat, meal analysis and morphology analysis are powered by AI model providers (primarily Anthropic for text and Google for vision, with fallback providers such as OpenAI in case of outage). Only the context each feature needs is transmitted: profile metrics, goals, equipment, recent performance, declared injuries, the messages you write to the coach for training and — if you connected your watch — aggregated recovery signals (e.g. "slept 5 h 10 min, HRV below their baseline", never the raw measurements); the meal photo for nutrition analysis; the photos you submit for morphology analysis. We do not send your name, email or any account identifier to the AI providers, and this data is not used to train their models under our API agreements.
5. Where your data lives
- Our servers are hosted by OVH in the European Union (France).
- Your media (profile photo, meal and morphology photos) is stored on the Bunny.net CDN (a European company, acting as a processor).
- When you scan a barcode, only the barcode number (EAN) is sent to the open Open Food Facts database to identify the product — never any personal data.
- Error reports are collected on our own self-hosted error tracker — they never leave our infrastructure.
- Health aggregates (sleep, HRV, resting heart rate, calories, steps, weight) are read from your phone's aggregator, stored locally, then synced to our OVH servers (France). We send nothing to Apple or Google — their aggregators already live on your device.
- Workout data is also stored locally on your device so the app works offline; it syncs to our servers when you are online.
- Subscription validation transits through RevenueCat (acting as a processor) and Apple/Google.
- If you sign in with Google or Apple, we only receive your email and name from the identity provider.
6. What we never do
- We do not sell your data.
- We do not show ads and do not track you across other apps or websites.
- We do not share your health-related declarations with anyone — they only shape your own programs.
- Your photos (meals, morphology) are used only for the analyses you trigger yourself; they are never used for anything else and you can delete them at any time.
- HealthKit / Health Connect data is never used for advertising, marketing or commercial profiling, and is never sold or passed to data brokers.
- Voice dictation is handled by your phone's native speech recognition — your voice never reaches our servers or an AI provider.
7. Legal bases
We process your data on the basis of: the contract between us (operating the service you signed up for), your consent (optional data such as injuries, meal and morphology photos, profile photo, push notifications — each can be withdrawn at any time), your explicit consent for health data within the meaning of GDPR Article 9 (declared injuries, morphology analysis, connected-watch data), and our legitimate interest in keeping the service reliable and secure (crash reports).
8. Retention
Your data is kept for as long as your account exists. When you delete your account, all personal data is deleted immediately and permanently (see below). Server logs are rotated within 30 days. Disconnecting your watch immediately stops health collection; already-synced history stays attached to your account (it feeds your trends) and is erased with it, or on simple request.
9. Deleting your account
You can delete your account at any time directly in the app: Profile → Delete my account. This permanently removes your account, profile, training history, statistics, messages and friendships. Programs you published that other users saved remain available to them in anonymized form (your authorship is removed). An active subscription must be cancelled separately in your App Store or Google Play settings.
10. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict and port your personal data, and to object to certain processing. Most of these are available directly in the app (profile editing, account deletion). For anything else, write to support@atpace.app — we answer within 30 days. You may also lodge a complaint with your supervisory authority (in France, the CNIL).
11. Children
AtPace is not directed at children under 15. We do not knowingly collect data from them.
12. Changes
We may update this policy as the service evolves. Material changes are announced in the app. The current version always lives at this address.